Semble
Senior Security Engineer (EN/FR)
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Are you a hands-on security professional ready to define what application security looks like in the age of agentic AI? Do you want to work somewhere that treats security as a genuine competitive advantage and a core part of building trustworthy healthcare software? Excited by the challenge of evolving security practice at pace, in an industry where the stakes are real?
This is not a pure compliance role, and it is not a pure red team role. It is a broad, technical, high-ownership position for someone who is equally comfortable threat modelling a new AI-powered product feature, owning your SAST and SCA pipelines, and contributing to an ISO 27001 audit.
About Semble
At Semble, we are on a mission to enable health professionals to amplify their impact. We improve the way healthcare is delivered to millions of people by providing doctors and their teams with powerful, innovative, intuitive, and secure software. Our cloud-based clinical system is already used by thousands of clinicians, making their lives easier and saving them money, while structuring their health data to help research.
We are a passionate and driven team, proud to unite under strong cultural drivers:
- Impact - We do work that matters
- Collaboration - We are in it together
- Human touch - We care deeply
We are also quick to embrace new technologies: we have rapidly adopted AI internally, and we actively look for people who are excited to augment and enhance their work with it.
About the IT Delivery & Security Services team
We believe the best IT is almost invisible. We are dedicated to building secure, intuitive systems that make self-service simple, automating routine work, streamlining complexity, and removing barriers. Many of our tools are already self-serve, and we are always pushing further. Our commitment to high standards has helped Semble achieve key security certifications and set the benchmark for best practice across the business. We champion clarity, transparency, and processes that are easy to understand and straightforward to follow.
We hold ourselves to a high standard every day. Our estate is always patched, always correctly provisioned, always documented; not because an audit is coming, but because that is simply how we work.
About the role
You will report directly to the Head of Information Security, working alongside a Senior Technical Support Engineer, and together you will form the senior backbone of the IT Delivery and Security Services team.
Security at Semble has until now been carried by a single person. This hire is about building genuine depth and maturity into the function. You will own a broad portfolio of security responsibilities, from application security and secure SDLC enablement to AI governance and security programmes, with significant autonomy to shape how that work gets done.
The product is evolving fast. AI is no longer a feature at Semble; it is becoming part of the core architecture. That means the attack surface is changing, the threat model is changing, and the skills required to stay ahead of it are changing too. We are looking for someone who is not just keeping up with that shift but is genuinely excited by it.
This is a startup environment: the work is varied, the pace is real, and you will have the opportunity to get your hands on almost everything. There is a meaningful backlog of projects to deliver as we mature the InfoSec function. If you want to define best practice rather than just follow it, this is it.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
This role is hybrid within France, with occasional travel to our London and Paris office for collaboration and workshops.
What you will be doing
Application Security and Secure SDLC
- Embed security into Agile development by partnering with engineering squads during planning, refinement, and delivery. Be the security voice in the room, not the person who reviews things after the fact.
- Define, roll out, and continuously improve secure coding standards, secure design patterns, and developer-friendly guidance that scales across the engineering team.
- Run threat modelling for new features and major architectural changes, capturing abuse cases and security requirements early. As Semble builds more AI-powered and agentic capabilities, apply emerging frameworks to ensure new threat surfaces are modelled and mitigated from the outset.
- Own SAST, SCA, DAST, container, and IaC scanning pipelines, with Snyk as our primary platform (Snyk Code, Open Source, Container, and IaC). Integrate with CI/CD, manage policies, and maintain a strong focus on developer experience and false-positive reduction.
- Triage and manage vulnerabilities end-to-end: classification, SLAs, fix validation, and reporting.
- Build frictionless guardrails: pre-commit hooks, secure templates, reference code, and paved paths that make doing the right thing the easy thing.
Security Architecture and Design
- Advise on architecture choices for key product feature developments, including authorisation, secrets and key management, data protection, and zero-trust-aligned designs.
- Guide secure API and microservice patterns, including input validation, rate limiting, secure session handling, and token-based security (OAuth 2.0/OIDC).
- Review designs for cloud-native services and edge components, ensuring sensible security trade-offs aligned to product goals.
- As agentic AI capabilities expand within the product, advise on the security architecture of agent orchestration, tool integrations, memory handling, and MCP (Model Context Protocol) server deployments.
AI Security and Governance
- Apply and evolve Semble's approach to AI-specific threats: prompt injection, excessive agent autonomy, tool and plugin abuse, AI supply chain risks, and context manipulation. The OWASP LLM Top 10 and OWASP Top 10 for Agentic Applications are your starting point, not your ceiling.
- Work closely with the Head of Information Security to develop and maintain Semble's AI governance posture, aligned with ISO 42001 and the evolving regulatory landscape for AI in healthcare.
- Assess risks associated with third-party AI integrations, AI-assisted development tooling, and agentic workflows, and implement appropriate mitigations.
Security Operations and Threat Management
- Monitor, investigate, and respond to security alerts, incidents, and anomalous behaviour across Semble's environment.
- Develop and mature threat intelligence capabilities, including vulnerability management, penetration testing coordination, and incident response processes.
- Maintain and improve security tooling, logging, and detection capabilities, with an automation-first mindset.
- Contribute to incident response runbooks for application-layer and AI-related incidents, and support blameless post-incident reviews to embed learning back into the SDLC.
- Contribute to the ongoing improvement of Semble's overall security posture, identifying and addressing gaps proactively.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Compliance, Certification and Audit Readiness
- Own or co-own the delivery of Semble's compliance programmes, including ISO 27001, Cyber Essentials+, NHS DSPT, and the journey towards SOC 2 readiness.
- Support and contribute to ISO 42001 implementation as Semble's AI governance framework matures.
- Define and track pragmatic security KPIs: time-to-remediate, coverage, percentage of criticals resolved within SLA, threat model coverage, and audit readiness indicators.
What we are looking for
Required
- Minimum of 5 years of experience in application security, product security, or a combination of software engineering and security with strong AppSec ownership.
- Hands-on experience with Snyk across SCA, SAST, Container, and IaC, including CI/CD integration and policy management.
- Fluent in French (mandatory)
- Strong grounding in modern web and application security: OWASP Top 10, API Security Top 10, and an emerging understanding of the OWASP Top 10 for Agentic Applications.
- Practical experience embedding security into Agile workflows and DevSecOps tooling.
- Solid understanding of authn/authz patterns, secrets management, encryption, and cloud-native security controls.
- Experience with compliance frameworks, particularly ISO 27001. Familiarity with Cyber Essentials+, NHS DSPT, or SOC 2 is a strong advantage.
- Practical understanding of AI security risks, including prompt injection, LLM vulnerabilities, and agentic system threats, and how to address them in a product context.
- Experience working in a SaaS environment or similarly regulated industry, with an appreciation of the product, engineering, and commercial context that security decisions sit within.
- Genuine, hands-on AI experience: not curiosity, but practice. We will ask you to speak to specific ways you are already using AI to improve security operations, detection, or engineering workflows.
- A track record of maintaining security programmes to a continuously high standard, with audit readiness as a default rather than a periodic event.
What you’ll get in return:
- The great feeling coming with knowing you do something that matters: shaping the future of healthcare!
- £80-90k package (based on your experience and the value you can bring)
- Competitive package reflecting the specialist and technical nature of this role, based on your experience and the value you bring, with details confirmed through the process.
- Autonomy and ownership – we’ll set the vision and share the context, then we trust you to run with things – that’s the reason we hire you!
- 36 days off: 25 holidays + bank holidays + 3 extra days (birthday and ‘feel good’ days) - that we will expect you to actually take so you can recharge and rest.
- Private Health Insurance – covering physical and mental health, as well as dental and optical!
- Hybrid & flexible work environment – work from anywhere in the UK, with also some flexibility to work across Europe. You decide how much or how little you go to the office.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location